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7> S]^3.B.Si\-o] o^^A^ol ^^^^-y ^^^^7> #^ll^>^Ai 
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'^^^ >ia.^Eo]l cflt!- ^ {METHOD TO DECRYPT AND ANALYZE THE 

ENCRYPTED MALICIOUS SCRIPTS} 

:£ 1 ^ ^ ^^<^1 '^^^ <a-^5i. 71^^ 

:£ 4 ^ ^ ^^ofl ttj-e^ it:£o^ ^:^l]3rl-^A-l 5flS-f-^7> 

^^^^<^1 ^^^^^ ^4-^ ^^V» ^^^^>^ 

£ 5 ^ S. 3 ^^^^ i^^MoflAi <^c>\:^ <yAi >i^^Eo:i c^i^ 

£ 6 ^ £ 5 sq- 'a^l i^^S* ^^ti: M-Hf^ <^1, 
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i^^m 7l^oll cUtb^^^^l AflS^ 7]'^^ #^ofl cfltl] 

<9> ^ti}-^ 'a-:£^(Encryption)^ n 3]u]7} ^e^;^! ^:£^ ^1^1^11- 

(Encoding)*}^ 7]^^ ^^Itb^]-. ne^i^, ^^e-] w>ol5l>, aVA^SJ^ofl 

n^^S.^^ ^2:(Scrambling)^<^l ^^fl ti>o]&|>i 7] (Scanner )7> 
AlzLu)^^ (Signature)* ^^1 ^«>£^ ^7]^ 7]^4r ^]^^^. ^1^:1^ 

cf^ «^wV^oi SSZL^ (Legitimate prograni)-i--4 ^^-^^^^-1- ^^s^fJl ^^^] <^^^ 
^>^Js:^<?1^]» ^^^V^c-ll ol-g-^cf. Aluq^S* oj^t!: ^^^3.^ ^^1 cf^ 71 

(Anti-virus) ^l^^^j o]e.]^ ^]rL'^^ 7]^9] ^i-^l «o>^^ ^fl^s>i Si-^H , '^I'^l 

^sl^Bj (Heuristic) ^^rJiel^* ^^tb ^^7} o]^j7 o;icf. 

:io> zL^c-ii, ojalt!- ^^1 «<}-^ofl >fl-g-*>7l ^*H, ^1^^>*^ wHel^cfl .g 

7l^^ ^7>*>J1 '^tiV^o.s., ^^^3.^^ ^^^^^\. 71^, 
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(Self-replication)-!- ^IS.^ "11 >^flS-^ ^1^* >«>>-§-*><^ 913.^ ^^-^S. ^ 

<ii> ^V^, ol&l^V <y-^SJ- HHe^i^oi] cfltb 7l^o.^^ ^^-5ll^UX-raying)2l- 6]] 
^ell<^l^d(Emulation) 711^01 A]-g-slji oicf, 7]^^ sfl^g- ^i-^^^^^ofl a-^ |J-o> 

^ ^^1- §tl ^-fl- Ali(Brute-force decryption)*}^ ^^i=l-. ^ 

S-S^ ;g-fc>ll 7>^^ S.S. 7]^^ o]^^c^ X\^x^^7} M-^^ ^ ^^1^ 
^^>^# n^^}3. ol^o] AlzLul^^iq- 7M^^11- ^A>s>c^ ^^^^^ o^-^ 

« ^siM-. <^l&ltl- #:ii^> -y-J:^ 7l^3i|- ^^^o] ^ 

^^^o] ^1^1 oi ^o^^ ^ofl ^^o] 7>^*Vs.s.. >^l|s. 

<12> ol]^el)ol^ 71^^ n^^3.^^ o\]^t]]o]^^}<:^ ^^^-^ 

'^I^ ^Hfl^ ^1-^^^^^ B^flS-^Elol 7K> ^^5)1:^, H 3.7]7} nfl-f ^j.^] 

. «11^<^1 ^cHifl^ji ^cfig 7}^7]:^]o] yJ^ ^S-A ^^l*l-«^ 

Alnq^ 7l«l:Sl >^]-g-*>^ ^-?-<Hl^ AizLq;^7> ^^Itb °ll2-e1 
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^^t}Jl AlzLi^^^ tiling ^^l^VTfl ^cf. o]^^ M.^ Al^^7>;<lo^ 

<H]l-5llol^ 7l^^ o]^ S}-<^ ^Eflo^ eflS-s-l^c-ll SL^^^m, ^^^S* ^ 

S. o]^-^^ ^^7} 3.7] nfl^olcf. tE^^ o}^^ ^tfl(Harm) ^>^1 ^«>2^ 

(Profiling)^m A>-g-^ ^s. ^4. 

^^^^s., >a-#^^ «o^^#^ ^^7> <a:^;?^ ;g-foil 

^^^^ 7]^^ ^^^^O] ih^^E OVAJ^^I- ^tb 7>^ ^-^^^ 7)1^ 

*>i4s^ ^^>^cHi <y-^5f^H ¥:n. o]^ ^s^e oio^oiiAi ^^s^^f^ 'execute' & 
-f-^ ^^^l7l^ ^Efls. ^^^sl^H $Zcf. ois^tb ^<=H^ ^^^^<^lAi 
■execute' &^-g- ^<^} o] ^^J-o1]a-^ ^#s1^ ^^1- gfls.^^^ <^1» 



24-7 



1020030016206 ^^ 'U^}: 2003/4/30 

<^1^^^ SS-H^ -y^'Hl'^i tt^^ -^^^cf. icl-el-^i, wV4 

^^tb <Hll-eflo]>aol ^^t}^] ^711 J^i:^ 7l^^^ 7>^ ^ ofl ^ gfl o] O.^. 

^5^^^ 7l«VSl AflS.^ oJ-j^Sl- 3fl^ol ol^. 

M-EfM-Jl ^^>«i cj-o^o^ o^^^cl] ^%t}7\] Cfl-g-^>7l «H^7fl ^ 

4. 
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^ «o^^^. ^^^^ ia.^Eo^ ovj^si. 7)1^^ *H^^^7> ^7i]^>igAi ^^^^ 

7]- Sl^A^ol ^^^4^<?1 ^4-. ^^^^7V #;cl]^>igA-l g|]S.^=-7]. sq 

<^ ^^^>£l, ^7] ^^^^7} ^7l]^>^Ai g|]S.^^7y Si]^^^S!fo^ S]^A^o] 



<17> olnfl, ^7] n^^^S] ^^3.^9^2] 9]^^^ , ^^^^ 

<18> ^ = ^S^^ofl ^^o^:g ^^o^ 7g^, 

<19> = :ia.^M<5]l ^^5^^ ^^(1< J<n), 

<20> ^ ^. = /^yOflAl ^jo^ ^\-%-^ 3.^ ^^^1 ^^(1< /^^), 

<22> = o^^ ^=^-oil£ #S^(global) <^^<^l>»>i ^fil >^>-§-^ ^ 
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<23> F / ^^2] AV-g-^ ^^o^ Ky ^ Cf^S] 



<24> 



<26> 



<28> 



<27> f-^ E . 7} t^^^ 



el- 'ii^ ^^^4^7> ^7)ls>i^Ai «)]=-^^7> iq^^^sq-o] o^i^^^o] 
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-^^V^ ^^^^^^ ^e], ^fl^^^fif 5>]-«-^^^o^ ^^^^^ ^-S.7> ^4. ^, 

o^^A^ol '^^ /7> S-^^olcf' ^Ji *>ji, olnfl ^^ 

(2) SS^^ i^^l^i, f ^%<^ cfl*]: ^ <^I^l-(Actual parameter)^ ^-^ 

^1 ^<=^A^^ ^^7> oi;^].^ ^0^:^ ;g o. ^§>c^ ^>s^>7i 

® ^-^--HlAi -^^^(Side effect )o] ^^'?]:^ :£#^H<=>> t!:^-. ^y\<^ 

€■ ^^^ItH ^^^^s -^^^^V^ ^^yf\A ^^"^A. 
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^n^^ 'S'H ^>*y^(Specification)<^l ^^l^^S. ^^^£1*^ 9X^:e.S. H ^^]^^ I/O -f- 

<^^011A^ Al^^ ^>^o^ ^^o. ^^^|.J7 ^ig- iflcflA^ Af^^V^;^!!- 

^A>sl-^ Z^<^o] HliU^ ^^*>7ll ol^^H^Cf. ::I51M-, Hl^<g Hflolal i^^ES!]- 

:e.ai ^as. *>^1 ^^i:!-. at!-. ^^<=>fl^i ^s^sj^^ci- *>Dl5l-£ Dim ^^^^ 
zi^ol ^^^J^ ^^l^V^l S-^ ^^S. :?>^^cf. ^ 

4. -SJisI^* ^tl: ^ i=1-#3]- ^o] >goi 

<38> n = ±.3.^E.c>\] ^Sl^ 

<39> 7?^. = >i^^Eo1] j-^^^S. ^j^^ ^=T^(1< /</?) 

<40> A / = F /<=^]^^ ^>-§-€ -2.^ ^^(1< /<y2) 

<4i> = F j^]^ Dim^S. ''d^^ S.^ ^^(1< / </7) 

<42> Va = 'H'S ^^<H1£ ^*>^1 #5.'g(global) *^^<^1A1 £^ A>-g-^ ^ 
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<43> olnfl, ^c- jr . ^^o^ AV^^ ^^o^ y.g^^ j, . s>\ 

^^oilA-l A>-g-^ ^^#21 Ol-sflo^ Ijzj. 2o\] 4 



<44> 



<45> ^ 
<47> 



^^^o] ^^S}- n^A^ 3.7\\ ^ 7>;^ls. ^ ^rf. aJ^^ 

VBS/VBSWG.TS M-Bl-^flcf. Hl^<i nflol^i >i^^eo] 'execute' 

^^d-^ <?1^>S &^>^* SSZL^ ijl ^^e>s.^, ^^^^1- ^ 

#*>7ll €^1-. ^^1 ^^7> ^^^1 Sn^^ ^ofl 7|]Al3r>7fl ^t:f. 

^s^^oflAi A}.^*!-^ ^^>^# <a-5:s)-t!: ^^s>^i. £ 3 ^ 
VBS/TripleSix S ^fi^^S* M-EfNHcV. oje]^ <^^^ arl- 
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Sfe ^ ol^vo^ o^^ sfls. 7>>^H, ol;^> cH^^^ 

(r-value) ^<^] ^>-§-5lfe ^y^^l ^^l-<iol oj-^s]-^ M.<^^^. ^^^^ , aJ^^ 

n^^^ ^^<^] ^-S-tb ^^Vl^^l ^^S]^ ^ 

^Eflo] 311^^ 211^^ ^^o^S-S. tm 7} 

^Efl^ 3.^'=^] cflt!: ^>^^1^ ^o] ;^}:^^o.^ *fl^ 

^t:f. ZL5li4, ^ ^^d\] 14= i^^Ho^ 71'^^ ^^d\] S.^ ^ 

^ lofl :g.o^^ ^A^^ 7].;^lj7 Sfl^oll ^^l^o] ^^*V 



<^1M- ^^tb 7]^o^ A>-g-cfl^ ^^l7l- n^^, ^^IS^tb S^Sl€r>7] 

^^^^ ^^^ss^ o}-^# ^s.^i.^cii -^^^^ ^^*>^ 
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cf. IL^]l^, Afl^Tfl ^^^tb o>^5i ^o] z3i{^ is^s 

^^s^- yji^sl #^o|i <^^i: s.^ Bfl^ofl o:i^3r]-^i sll^ 

<^le1^ ^;^1<H1 cflufl ^ ^^oflA^ ;^lt>^>^ tfl^ ^i^^E7> 

>^l-^;^>7> si^§>^] ^§>3£^ «fl<^>*l-^ ^^s. «y 

«fl, i^fl^^^ = ^ A>-g-:^> ^-^H 0]:=. Al:iEfl6llAii4 

^sll S^^tt 4€*>^<^> s>^S o]^^ ;g^ol rH^ 

-H-^ 1^ ^^^^7> ^-^^^^ ^^11^>^^. ^^^1 ^^^^o] 
cfl^lsr>^ ^nVo.^ ifl-g-^ Sfl^-o] 7V^^]-i4. £ 4 ^ ^^<^1 n^-e}- ^£oj 
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^^^^7> ^^fl^V^Ai 5}ls-^^7> o^^A^o] ^fe ^^^^^ ^-f^ -y-^ 

^^>» ^^^>^ SLf-Solc^-. £ 4 » ^i-S^}^, ^-^^^<^1 ^#^(Call 
express! on) ^^^^1- ^#*><^ , ^^*>7lvJ|- 6111-2l]ol>jat!:CKS410,S420) . o] 

tfl^l^V'^ i^^J^» #l^f]:q-(S430,S440). o]^, '^S. 

tb ^^^S^l^l^l ^^c^-. ^^^^^ el€^^ 4ef '?1^H1'?> "^^^ 

^ ^J-EflollA^ ^*5^>o^:£ ^o^^ oi^Hl cfl^A^ -^<yt!: <lV#^71 nfl 



^O] 7>^*>2.S., ol^VoflA^^ :f-t|l ^Jlj. AV31I1- ^lAl^Vtq-. 

» 'a^l >i3L^H^ cf-i-oil- S-^^-S. ^A^*>^ ^ol n} 

a. ^'U 7l]«j- ^ 

b. ^^ ^# ^ a)^ 5;!:* Sj-^^oll 7]^ 
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<6i> c. 

<62> d. ^Ir^Ctype handling) ^^2] 

<63> S. 5 S. 3 <H1 ^1^1^ ^a.^Eoi]A^ <g<>|^ ^s^E^ <=iS.^^, 

<65> f. 5L^^>i 9X^ ID 

<66> g. ^u2f 7jol 

<67> h. ^3}.^ 

<68> ojei^v ^oflAi ^4 ^^].<g ^oisq- ^s)-^;^^ Bf<a 

^=T-» -^^ ^«=H^4. Ef<^ ^1:^ ^^o^ ^^11^ Hflol^] ^>^^oi] 71 

<?lt!: ^-^S, w]^<g aflol^ >i3.^Moll^ -Variant' e^-^ ^ «}• 71-^1^ e1-SJ'?><^1 ^^fl 
^1-°^ ^^^'^] ^^^M ^>2fl^ S 1 32). subtype) ^1 ^^^4. . 

aflojaj ^3.^E.S] n>^l cfl^^ ^o] uflHj cfs e^-oJ^ o]^].^ 

ZLofl XX^^ Cf^ Ei-<a2i # ^£ 

<69> 
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Subtype 


Descr ipt ion 


Conver tile 


vbEmpty 


Empty (uninitialized) 


X 


vbNull 


Null (no valid data) 


X 


vblnteger 


Integer 


0 


vbLong 


Long integer 


0 


vhSi ne\ p 


S 1 np' 1 p^nrpp i ^ i nn f 1 cm t i ncr — nn i n t niimKf»r 

vJ 1 llg 1 1^1 \^ Vw^ 1 O 1 Wii 1 X Wd L 1 1 11 L lllUllLrd 




vbDouble 


Double-precision floating-point number 


0 


vbCurrency 


Currency 


0 


vbDate 


Data 


0 


vbStr ing 


String 


0 


vbObject 


Automation object 


X 


vbError 


Error 


X 


vbBoolean 


Boolean 


0 


vbVar iant 


Variant ( used only with arrays of Variants) 


X 


vbDataObject 


A data-access object 


X 


vbByte 


Byte 


0 


vbArrav 


Arrav 


X 



<=>]^^ til^<g ^o]^ ^3^^^$] ^^^0_s. 91^ Bl-<y^ ^Al 

^5^^*>ji ^^s>^ T^o. -j_ Die] ^<>| ^^^Eo) ^#Aioii 

'^\^^ %^ ^^^^\7] ^n^]^, ^A"^^ <y=#<=Hl^ t4-S-a#, Date Efojo^ 

^le-itb ^^1^ ^n, ^^A^ S-W^^ £ 5 «H1 RunFuncS. 

S. ^ -¥-Hf<?J* 7}^^ ^^^o] ^4^^ ^ol» 0 -^S. 7l^f- 
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^l^^i, 4^^* *«fl 'a^l rfi^^M7} -^J^^S]^. 

Jl^mCWindows Scripting Host)^ o]* ^^^l^s^ Sfl^ 

^l^^l ^4^ol <ao^^l^, ol ^i^^Eo^l cfl^l^H 

2}-«^ollA] atb 3:#<^1 ^^*>7fl tfl^l^ S.^^^o^ ;go) 

^^<H] oV^-ei <^^^ x^^]^ ^ oic^ cfl^l 

S\^o^x:^ VSq- 3.^ SL%^o] ^uzj-^o.^. rfl^lS)ol ^^o^ ;^o:)7> aV;^!^ 
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I^i^lj- 11 

oj-^^sj. 7]!^^ «flS.^>-7]. ^7ll§>igA^ <i\^3.B.Si\.^ 

^^^io] ^^^^o] y^o. ^^m'^^^ n^^^yy s>\^3.b.s^s] 

^7] ^^^^7} s]^^.^^^^] o^^^^o] ^^f-^<?i 

^7] ^^^^6\] cHtb «-^^^» ^#^>^ 

2] 
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3] 

= iH^S<^l /Willis. ^$]^ ^T^(l< /</?), 
^ / = f-^ /-y^HlAi afe AV-g.^ s.^ ^^o^ ^^(1< i^n), 

K o = ^^ofls ^^>^1 (global) <=g^<HlH ^>-8-€ ^ 

^/ ^s] A>-§-^ ^4.0^ V i ^ cf^^ 

^.= ^.-A oil n^l- ^*>:a. 

iT^.o^ -^^"^lA^ SE^ A>-g.^ ^^1-^ ^"/^ t:f^Sl ^^h^l 
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l£ 11 



r BE21 8fl^ sxH 



2] 



£xecute(snphhuatvsbkwuj{"&Wcr/Wcrvf/H.Vnsl/@w doelgtobuhno')) 

Function snphhuatvsbkwuj(zwbyintbpmhqqgh) 

For vvpzxfszgnczrao = 1 To Len(zwbyjnlbpmhqqQh) 

ccuhbhjhyzkheeq = Mid(zwbyjntbpmhqqgh, vvpzxfszgnczrao. 1) 
If Asc(ccuhbhjhyzkheeq) = 7 Then 

ccuhbhjhyzkheeq =Chr(34) 
End If 

If Asc(ccuhbhihyzkheeq) <> 35 and Asc(ccuhbhjhyzkheeq) <> 34 Then 
If Asc(ccuhbhjhyzkheeq) Mod 2 = 0 Then 

ccuhbhjhyzkheeq = Chr(Asc(ccuhbhjhyzkheeq) + 1) 

Else 

ccuhbhjhyzkheeq = Chr(Asc(ccuhbhjhyzkheeq) - 1) 
End If 
End If 

snphhuatvsbkwuj = snphhuatvsbkwuj & ccuhbhjhyzkheeq 

Next 
End Function 



is. 3] 



Set Roy = Maggie.CreateTextFile(Maggie.BuildPath(Maggie.GetSpeciaIFolder{2).V(7594E44554D405E2458545')).True) 
Roy.WriteLine(V(''E402') & Maggie.BuildPath{Maggie.GetSpecialFolder(2).VC7594E44554D405E245D405"))) 
Roy.WrlteLineCe 0100' & HC4O5AE70t 630001 0006002406FFFF5FOC")) 
Roy.WriteLineCE 0110' & H('000200000001FOFF5700000001 325048')) 



Function V(Van) 

For Kirk = 1 To Len(Van) Step 2 

V = V & ChrC&h' & Mid(Van.Ki:k + 1.1) & Mid(Van.Kirk.1)) 

Nexl 
End Function 



Function H{Houten) 

For Luann = 1 To Len(Houlen) Step 2 
H = H & • ■ & Mid(Houlen.Luann.2) 

Next 
End Function 
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[S. 41 



S410 



S420 



S430 



S440 



5] 



ABi moj iHttt- I Set FSO = CfeateObiectCScriptino.FiteSystemObiect') 
st^ jno Set OecryDt FSO.CreatoTextFlleCrBsult.txtVTrue) 



5,^4- m# 



I Set Decrypt - FSO.CreatoTextFlle('result.txf.True) 

Decrypt.wnteUne 23 & " ' & 90 & " ' & 31 & ' ' & 3264 & " & RunFunc (v ( •7594E44554D40513E2241445" ) ) 
Decrypt .WriteUne 24&'*&21 & "'&25&" & 3264 & ' " & RunFunc (v ( '04563686F602F66666* ) ) 



Sl-^ I Decrypt.close 



§°i 



§2J 



Function V/(Van) 

End Function 
Function H(Houten) 

End Function 

Function RunFunc(para) 

retValue = para 

retType = VarType(retValue) 

If (retType >= 2 and retType <=6) or retType = 1 1 or retType = 17 Then 

RunFunc = Len(CStr(retVatue)) . 
ElseK retType = 7 Then 

relValue = '#■ & retValue & '#* 

RunFunc = Len(CStr{retValue)) 
Elself retType = 8 Then 

retValue = Chr(34) & retValue & Chr(34) 

RunFunc = Len(CStr(retValue)) 
Else 

RunFunc = '0" 
End II 

If RunFunc <> 'O* Then 

RunFunc = Runfunc & * ' & retValue 
End If 

End Function 
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[S. 61 


orlginaLexpr 


return.value 


row col len funcID 


len string 


22 28 59 3264 


28 "Scripting.FileSysteniObiect" 


23 90 31 3264 


14 "WINTaiPl.BAr 


24 21 25 3264 


11 'fecho off 


25 21 29 3264 


13 'debug. exe <" 


25 105 29 3264 


13 "WINTBilP.TXT" 


25 140 17 3264 


7 " >nul' 


7] 



set raaggie = crealeobjecl ("Script ing.FileSystepObject") 

set fliarjorie = inaogie.createtextfile(iiiagoie.buildpath(magoie.getspeciallol(ter(2). 'WINTEMPt.BAD). true) 
inarjorie.writeline("§echo off) 

liiafjofie.writelineC'debug.exe <" & iiiaggie.buildpath(iiiaggie.getspecialfolder(2). "WINTEHP.m") & " >nur) 
mar jorie. close 

set roy = inaggie.createtexlfiIe(fliaggie.buildpatfi(inaggie.gelspecialfolder(2), "WINTBIP.TXT"). true) 
roy.writelineCN " & niaggie.buildpalh(Baggie.getsp8cialfolder(2). "fflHTaiP.llIP''}) 
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